Authorization code
An authorization code is a short-lived, single-use OAuth credential that a client exchanges at an authorization server for tokens.
A short-lived step before tokens
After an OAuth authorization decision, the authorization server returns a code to the client through a browser redirect. The client sends that code to the token endpoint. Tokens are issued only if the exchange passes the required checks.
The code is bound to the client ID and redirect URI. OAuth requires it to be short-lived and used no more than once; the exact lifetime depends on the provider.
An access token goes to a protected API. A refresh token requests more access tokens. The authorization code comes earlier, so finding one does not tell you whether an API request succeeded.
Why copying a code matters
The code travels through the browser, but the token exchange happens at a separate endpoint. With PKCE, the client also presents a verifier tied to the original request. Possessing the code alone should not satisfy that check. Confidential clients also authenticate as required by their authorization server.
Check the client, redirect configuration, and token endpoint. Use PKCE and the provider’s current library guidance. Review consent separately: a successful code exchange does not mean the requested permissions were appropriate.